The GDPR will apply to most electronic marketing activities, as these will involve some use of personal data (eg, an email address which includes the recipient's name). The most plausible legal bases for electronic marketing will be consent, or the legitimate interests of the controller (which is expressly referenced as an appropriate basis by Recital 47). Where consent is relied upon, the strict standards for consent under the GDPR are to be noted, and marketing consent forms will invariably need to incorporate clearly worded opt-in mechanisms (such as the ticking of an unticked consent box, or the signing of a statement, and not merely the acceptance of terms and conditions, or consent implied from conduct, such as visiting a website).

Data subjects have an unconditional right to object to (and therefore prevent) any form of direct marketing (including electronic marketing) at any time (Article 21(3)).

Specific rules on electronic marketing (including circumstances in which consent must be obtained) are to be found in Directive 2002/58/EC (ePrivacy Directive), as transposed into the local laws of each Member State. The ePrivacy Directive is to be replaced by a Regulation. However, it is currently uncertain when this is going to happen, as the European Commission has discarded its draft of the ePrivacy Regulation after disagreements by the Member States in the Council of the European Union. In the meantime, GDPR Article 94 makes it clear that references to the repealed Directive 95/46/EC will be replaced with references to the GDPR. As such, references to the Directive 95/46/EC standard for consent in the ePrivacy Directive will be replaced with the GDPR standard for consent.

The Regulation of Electronic Communications and Postal Services Law of 2004 (112(I)/2004) as amended (the "Electronic Communications and Postal Services Law") will apply to most electronic marketing activities, as there is likely to be processing and use of personal data involved (eg, an email address is likely to be personal data for the purposes of the Electronic Communication and Postal Services Law).

Section 106 of the Electronic Communications and Postal Services Law states the following:

1. The use of automated calling and communications systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail, for the purposes of direct marketing, may only be allowed with respect to subscribers who have given their prior consent.
2. Notwithstanding the provisions of section (1) above, where a natural or legal person obtains contact details for electronic mail directly from its customers, in the context of the sale of a product or service, in accordance with the provisions of Regulation (ΕU) 2016/679 and the Law, such person may use the said details for direct marketing of its own similar products or services, provided that customers are given the opportunity to object clearly and distinctly, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message where the customer has not initially refused such use.
3. The Commissioner of Electronic Communications and Postal Regulation, upon consultation with the Commissioner for the Protection of Personal Data, shall take all appropriate measures to ensure that unsolicited calls for the purpose of direct marketing, save in the cases provided for in sections (1) and (2) above, are not allowed without the consent of interested subscribers or users.
4. In any event, the practice of sending electronic mail for the purposes of direct marketing disguising or concealing the identity of the sender or the person on whose behalf and/or for whose benefit the communication is made, in violation of Section 9 of the Certain Aspects of Information Society Services and in particular Electronic Commerce and Related Matters Law, or without a valid address to which the recipient may send a request that such communications cease, or encouraging recipients to visit websites that violate this Section, shall be prohibited.
5. Sections (1) and (3) above shall apply to subscribers who are natural persons. The Commissioner of Electronic Communications and Postal Regulation shall also ensure, in the framework of European Union law and the applicable national legislation, that the legitimate interests of subscribers other than natural persons with regard to unsolicited calls are sufficiently protected. To this end, the provisions of the Order on the Legal Persons (Safeguarding of Legitimate Interests concerning Unsolicited Communications) of 2005, issued by the Commissioner of Electronic Communications and Postal Regulation, shall apply.
6. Every natural or legal person adversely affected by violations of Section 106 and therefore having a legitimate interest in such violations being terminated or prohibited, including the providers of electronic communications services that protect their legitimate business interests, may apply to the competent courts. The Commissioner of Electronic Communications and Postal Regulation, upon consultation with the Commissioner for the Protection of Personal Data, may also establish special rules on the penalties that apply to providers of electronic communications services that contribute, by negligence, to violations of the national provisions enacted under this Section.